[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2024-4067":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-01T16:22:42.503Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":24,"aliases":34,"duplicate_of":9,"upstream":36,"downstream":37,"duplicates":50,"related":51,"reserved_at":9,"published_at":65,"modified_at":66,"state":67,"summary":68,"references_raw":76,"kevs":140,"epss":141,"epss_history":144,"metrics":412,"affected":422},"CVE-2024-4067","The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-1333","Inefficient Regular Expression Complexity","The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.","weakness","Draft","Base","High",[20],{"id":21,"name":22,"techniques":23},"CAPEC-492","Regular Expression Exponential Blowup",[],[25],{"_key":26,"name":27,"source":28,"url":29,"maturity":30,"reliability_score":31,"verified":32,"type":9,"platforms":33,"requires_auth":9,"exploitdb":9,"metasploit":9},"REF_5C136DBC96BA9278","Exploit Reference (advisory.checkmarx.net)","reference","https://advisory.checkmarx.net/advisory/CVE-2024-4067/","unknown",0.2,false,[],[35],"GHSA-952p-6rrq-rcjv",[],[38,40,42,44,46,48],{"_key":39},"SUSE-SU-2024:3771-1",{"_key":41},"OPENSUSE-SU-2025:14663-1",{"_key":43},"MGASA-2025-0194",{"_key":45},"UBUNTU-CVE-2024-4067",{"_key":47},"DEBIAN-CVE-2024-4067",{"_key":49},"RHSA-2024:8906",[],[52,53,54,55,57,59,61,63],{"_key":39},{"_key":41},{"_key":43},{"_key":56},"CGA-6Q83-777J-GP5R",{"_key":58},"CGA-7J2F-JXVW-GX52",{"_key":60},"CGA-9HV5-RMVP-37VW",{"_key":62},"CGA-9QJ8-PH43-6PQ5",{"_key":64},"CGA-GV3C-32MV-3QVR","2024-05-13T10:04:42.886Z","2024-09-17T19:47:41.783Z","Analyzed",{"cisa_kev":32,"cisa_ransomware":32,"cisa_vendor":9,"epss_severity":69,"epss_score":70,"severity":71,"severity_score":72,"severity_version":73,"severity_source":74,"severity_vector":75,"severity_status":67},"low",0.01429,"medium",5.3,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",[77,83,91,95,100,104,110,114,118,123,127,131,135],{"url":78,"sources":79,"tags":81},"https://devhub.checkmarx.com/cve-details/CVE-2024-4067/",[74,80],"nvd",[82],"Third Party Advisory",{"url":84,"sources":85,"tags":87},"https://github.com/micromatch/micromatch/pull/266",[74,80,86],"osv_npm",[88,89,90],"Issue Tracking","Patch","WEB",{"url":92,"sources":93,"tags":94},"https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade",[74,80,86],[89,90],{"url":96,"sources":97,"tags":98},"https://github.com/micromatch/micromatch/releases/tag/4.0.8",[74,80,86],[99,90],"Release Notes",{"url":29,"sources":101,"tags":102},[74,80],[103,82],"Exploit",{"url":105,"sources":106,"tags":107},"https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448",[74,80,86],[108,109,90],"X Transferred","Product",{"url":111,"sources":112,"tags":113},"https://github.com/micromatch/micromatch/issues/243",[74,80,86],[108,88,90],{"url":115,"sources":116,"tags":117},"https://github.com/micromatch/micromatch/pull/247",[74,80,86],[108,88,89,90],{"url":119,"sources":120,"tags":121},"https://nvd.nist.gov/vuln/detail/CVE-2024-4067",[86],[122],"Advisory",{"url":124,"sources":125,"tags":126},"https://github.com/micromatch/micromatch/commit/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0",[86],[90],{"url":128,"sources":129,"tags":130},"https://advisory.checkmarx.net/advisory/CVE-2024-4067",[86],[90],{"url":132,"sources":133,"tags":134},"https://devhub.checkmarx.com/cve-details/CVE-2024-4067",[86],[90],{"url":136,"sources":137,"tags":138},"https://github.com/micromatch/micromatch",[86],[139],"PACKAGE",[],{"date":142,"score":70,"percentile":143},"2026-07-06",0.69774,[145,149,152,155,158,161,164,167,170,173,176,179,182,184,187,191,194,197,200,203,206,209,212,214,217,220,223,226,230,233,236,239,241,244,247,250,253,256,259,262,265,268,271,274,277,280,283,286,289,291,294,297,300,303,306,309,312,314,317,320,323,326,329,332,335,338,340,343,346,349,352,355,358,361,364,367,370,373,376,379,382,385,388,391,394,397,400,403,406,409],{"date":146,"score":147,"percentile":148},"2025-11-04",0.00126,0.32675,{"date":150,"score":147,"percentile":151},"2025-11-05",0.32658,{"date":153,"score":147,"percentile":154},"2025-11-06",0.32662,{"date":156,"score":147,"percentile":157},"2025-11-07",0.32679,{"date":159,"score":147,"percentile":160},"2025-11-08",0.32677,{"date":162,"score":147,"percentile":163},"2025-11-09",0.32654,{"date":165,"score":147,"percentile":166},"2025-11-10",0.32602,{"date":168,"score":147,"percentile":169},"2025-11-11",0.32626,{"date":171,"score":147,"percentile":172},"2025-11-12",0.32671,{"date":174,"score":147,"percentile":175},"2025-11-13",0.32687,{"date":177,"score":147,"percentile":178},"2025-11-14",0.32689,{"date":180,"score":147,"percentile":181},"2025-11-15",0.32688,{"date":183,"score":147,"percentile":154},"2025-11-16",{"date":185,"score":147,"percentile":186},"2025-11-17",0.32634,{"date":188,"score":189,"percentile":190},"2025-11-18",0.02296,0.83374,{"date":192,"score":189,"percentile":193},"2025-11-19",0.83376,{"date":195,"score":189,"percentile":196},"2025-11-20",0.83382,{"date":198,"score":147,"percentile":199},"2025-11-21",0.32674,{"date":201,"score":147,"percentile":202},"2025-11-22",0.32676,{"date":204,"score":147,"percentile":205},"2025-11-23",0.32649,{"date":207,"score":147,"percentile":208},"2025-11-24",0.32621,{"date":210,"score":147,"percentile":211},"2025-11-25",0.32618,{"date":213,"score":147,"percentile":211},"2025-11-26",{"date":215,"score":147,"percentile":216},"2025-11-27",0.32627,{"date":218,"score":147,"percentile":219},"2025-11-28",0.32608,{"date":221,"score":147,"percentile":222},"2025-11-29",0.32592,{"date":224,"score":147,"percentile":225},"2025-11-30",0.32566,{"date":227,"score":228,"percentile":229},"2025-12-01",0.00105,0.29143,{"date":231,"score":228,"percentile":232},"2025-12-02",0.29169,{"date":234,"score":228,"percentile":235},"2025-12-03",0.29177,{"date":237,"score":147,"percentile":238},"2025-12-04",0.32573,{"date":240,"score":147,"percentile":219},"2025-12-05",{"date":242,"score":147,"percentile":243},"2025-12-06",0.32611,{"date":245,"score":147,"percentile":246},"2025-12-07",0.32587,{"date":248,"score":147,"percentile":249},"2025-12-08",0.32597,{"date":251,"score":147,"percentile":252},"2025-12-09",0.32646,{"date":254,"score":147,"percentile":255},"2025-12-10",0.32708,{"date":257,"score":147,"percentile":258},"2025-12-11",0.32735,{"date":260,"score":147,"percentile":261},"2025-12-12",0.32769,{"date":263,"score":147,"percentile":264},"2025-12-13",0.32752,{"date":266,"score":147,"percentile":267},"2025-12-14",0.3273,{"date":269,"score":147,"percentile":270},"2025-12-15",0.32681,{"date":272,"score":147,"percentile":273},"2025-12-16",0.32707,{"date":275,"score":147,"percentile":276},"2025-12-17",0.32763,{"date":278,"score":147,"percentile":279},"2025-12-18",0.32814,{"date":281,"score":147,"percentile":282},"2025-12-19",0.32839,{"date":284,"score":147,"percentile":285},"2025-12-20",0.32821,{"date":287,"score":147,"percentile":288},"2025-12-21",0.32762,{"date":290,"score":147,"percentile":267},"2025-12-22",{"date":292,"score":147,"percentile":293},"2025-12-23",0.32724,{"date":295,"score":147,"percentile":296},"2025-12-24",0.32721,{"date":298,"score":147,"percentile":299},"2025-12-25",0.32789,{"date":301,"score":147,"percentile":302},"2025-12-26",0.32774,{"date":304,"score":147,"percentile":305},"2025-12-27",0.32781,{"date":307,"score":147,"percentile":308},"2025-12-28",0.32684,{"date":310,"score":147,"percentile":311},"2025-12-29",0.32655,{"date":313,"score":147,"percentile":205},"2025-12-30",{"date":315,"score":147,"percentile":316},"2025-12-31",0.327,{"date":318,"score":228,"percentile":319},"2026-01-01",0.2937,{"date":321,"score":228,"percentile":322},"2026-01-02",0.29366,{"date":324,"score":228,"percentile":325},"2026-01-03",0.29348,{"date":327,"score":147,"percentile":328},"2026-01-04",0.32683,{"date":330,"score":147,"percentile":331},"2026-01-05",0.32669,{"date":333,"score":147,"percentile":334},"2026-01-06",0.32682,{"date":336,"score":147,"percentile":337},"2026-01-07",0.32703,{"date":339,"score":147,"percentile":267},"2026-01-08",{"date":341,"score":147,"percentile":342},"2026-01-09",0.32736,{"date":344,"score":147,"percentile":345},"2026-01-10",0.32734,{"date":347,"score":147,"percentile":348},"2026-01-11",0.32709,{"date":350,"score":147,"percentile":351},"2026-01-12",0.32636,{"date":353,"score":147,"percentile":354},"2026-01-13",0.3262,{"date":356,"score":147,"percentile":357},"2026-01-14",0.32668,{"date":359,"score":147,"percentile":360},"2026-01-15",0.32664,{"date":362,"score":147,"percentile":363},"2026-01-16",0.32686,{"date":365,"score":147,"percentile":366},"2026-01-17",0.3267,{"date":368,"score":147,"percentile":369},"2026-01-18",0.32612,{"date":371,"score":147,"percentile":372},"2026-01-19",0.32579,{"date":374,"score":147,"percentile":375},"2026-01-20",0.3256,{"date":377,"score":147,"percentile":378},"2026-01-21",0.32518,{"date":380,"score":147,"percentile":381},"2026-01-22",0.32486,{"date":383,"score":147,"percentile":384},"2026-01-23",0.32549,{"date":386,"score":147,"percentile":387},"2026-01-24",0.32557,{"date":389,"score":147,"percentile":390},"2026-01-25",0.32487,{"date":392,"score":147,"percentile":393},"2026-01-26",0.32397,{"date":395,"score":147,"percentile":396},"2026-01-27",0.32385,{"date":398,"score":147,"percentile":399},"2026-01-28",0.32358,{"date":401,"score":147,"percentile":402},"2026-01-29",0.32317,{"date":404,"score":147,"percentile":405},"2026-01-30",0.32309,{"date":407,"score":147,"percentile":408},"2026-01-31",0.32319,{"date":410,"score":228,"percentile":411},"2026-02-01",0.28944,[413,418,420],{"source":74,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":414,"cvss_v4_0":9},{"baseScore":72,"baseSeverity":415,"vectorString":75,"impactScore":416,"exploitabilityScore":417},"MEDIUM",2.3,10,{"source":80,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":419,"cvss_v4_0":9},{"baseScore":72,"baseSeverity":415,"vectorString":75,"impactScore":416,"exploitabilityScore":417},{"source":86,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":421,"cvss_v4_0":9},{"baseScore":72,"baseSeverity":9,"vectorString":75,"impactScore":416,"exploitabilityScore":417},[423,434,438],{"ecosystem":9,"name":424,"vendor":425,"product":424,"cpe_part":426,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":427},"micromatch","jonschlinkert","a",[428],{"version":429,"is_range":430,"range_type":431,"version_start":9,"version_start_type":9,"version_end":432,"version_end_type":433,"fixed_in":9},"lt4.0.8",true,"cpe","4.0.8","excluding",{"ecosystem":9,"name":424,"vendor":424,"product":424,"cpe_part":426,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":435},[436],{"version":437,"is_range":430,"range_type":74,"version_start":9,"version_start_type":9,"version_end":432,"version_end_type":433,"fixed_in":9},"\u003C 4.0.8",{"ecosystem":439,"name":424,"vendor":439,"product":424,"cpe_part":9,"purl_type":440,"purl_namespace":9,"purl_name":424,"source":9,"versions":441},"Npm","npm",[442],{"version":443,"is_range":430,"range_type":444,"version_start":9,"version_start_type":9,"version_end":432,"version_end_type":433,"fixed_in":9},"lt4_0_8","semver"]